Dashboards & Visualizations

Use eval to reference a $token$

mansel_scheffel
Explorer

Hi,

I have a dashboard that is populated by an input.. It selects the index.. I am using the following search based on that to populate a dashboard:

index=_internal source=license_usage.log type=Usage pool= | stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's

I want it to select whichever index the user chooses in the input.. So I need to use eval to make idx=$index_name$ or something to reference the right idx from the log by using the input dropdown.

Any thoughts?

Thanks,

0 Karma
1 Solution

DMohn
Motivator

If I get it correct you want to be able to have the user to select a value from a input field (dropdown, etc) and then limit the results of your search to the selected value for idx?

First, you should create a input, that only lets the user select valid fields for idx. In your case (internal license usage) this would be the following XML code for a dropdown selector:

 <input type="dropdown" token="token_idx">
  <label>IDX</label>
  <search>
    <query>index=_internal source=*license_usage.log | fields idx | dedup idx</query>
  </search>
  <fieldForLabel>idx</fieldForLabel>
  <fieldForValue>idx</fieldForValue>
 </input>

Then you can integrate the selected value by integrating the $token_idx$ token into your search:

 index=_internal source=*license_usage.log type=Usage idx=$token_idx$| stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's

View solution in original post

0 Karma

DMohn
Motivator

If I get it correct you want to be able to have the user to select a value from a input field (dropdown, etc) and then limit the results of your search to the selected value for idx?

First, you should create a input, that only lets the user select valid fields for idx. In your case (internal license usage) this would be the following XML code for a dropdown selector:

 <input type="dropdown" token="token_idx">
  <label>IDX</label>
  <search>
    <query>index=_internal source=*license_usage.log | fields idx | dedup idx</query>
  </search>
  <fieldForLabel>idx</fieldForLabel>
  <fieldForValue>idx</fieldForValue>
 </input>

Then you can integrate the selected value by integrating the $token_idx$ token into your search:

 index=_internal source=*license_usage.log type=Usage idx=$token_idx$| stats sum(b) as b by idx | eval GB's=round((b) /1000/1000/1000,2) | rename idx as Index | fields Index GB's | sort 20 - GB's
0 Karma

mansel_scheffel
Explorer

Thanks exactly what I needed!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...